For an application two-node cluster whose active node and standby node share a disk in a current physical environment, two-node cluster software is installed on two machines respectively and one shared disk is partitioned using an fibre channel storage area network (FC-SAN) or an Internet Protocol storage area network (IP-SAN), where access to the disk is limited to only two specified physical machines. The shared disk is regarded as a group of resources and controlled by the two-node cluster software (for example, a Veritas Cluster Server). During a switchover of two nodes in the application two-node cluster in warm standby or cold standby mode, the shared disk is mounted to the originally standby node only after it is unmounted from the originally active node to ensure that only one machine operates the shared disk at a time.
A physical two-node cluster system in the prior art is managed by an independent component. When the two-node cluster is incorrectly configured, a brain-split problem, that is, data damage due to simultaneous access of the two nodes to the shared disk, may easily occur.
To avoid the brain-split problem of the two-node cluster system, the following solution is provided in the prior art. In addition to the two-node cluster, a machine is introduced as a reference active node. When heartbeat communication between the active node and the standby node is faulty, to identify an isolated node, both the active node and the standby node ping an IP address of the reference active node, and the one that fails to ping the IP address of the reference active node actively releases control over the disk.
A disadvantage of this solution is that, when the active node is powered off, a system core dump occurs, or a control program is abnormal, the active node cannot release control over the disk. As a result, the standby node cannot assume control over the shared disk to provide services, thereby causing a long-time service interruption. In addition, this solution requires that a reference active node be configured, while the reference active node may be an external application component, whose reliability is difficult to ensure.